suse · CVE-2020-28366

Quick triage

View at Official suse advisory, NVD, CVE.org · CVE detail

Freshness: upstream tracker timestamp is available; use API updated time as primary recency signal.

Tracker summary

CVE-2020-28366 severity important: SUSE including 30 source package names (delve-1.4.1-1.module+el8.3.0+7840+63dfb1ed, go-toolset-1.14.12-1.module+el8.3.0+8784+380394dc, …), 62 product×package rows across 12 product lines (SUSE Liberty Linux 8, SUSE Linux Enterprise Module for Development Tools 15 SP1, … (12 product lines)): Fixed 62.

Description:

Code injection in the go command with cgo before Go 1.14.12 and Go 1.15.5 allows arbitrary code execution at build time via a malicious unquoted symbol name in a linked object file.